# Watcher not triggering alerts

**URL:** <https://discuss.elastic.co/t/watcher-not-triggering-alerts/228304>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [April 16, 2020, 11:19am UTC](https://discuss.elastic.co/t/watcher-not-triggering-alerts/228304 "2020-04-16T11:19:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![namar321](https://avatars.discourse-cdn.com/v4/letter/n/4af34b/32.png) [@namar321](https://discuss.elastic.co/u/namar321)\
**Post date:** [April 16, 2020, 11:19am UTC](https://discuss.elastic.co/t/watcher-not-triggering-alerts/228304/1 "2020-04-16T11:19:31Z")

</div>

Hello. We set up an ML job to identify anomalous events which runs every 15 minutes. While the job is able to find the events, the watcher that runs every 15 minutes is not triggered. Any tips on implementing the watcher to pick up results from the ML Job will be help.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [April 18, 2020, 1:41pm UTC](https://discuss.elastic.co/t/watcher-not-triggering-alerts/228304/2 "2020-04-18T13:41:09Z")

</div>

Make sure the "look back" interval of the query the Watch makes to the `.ml-anomalies-*` index pattern is 2 times the value of the `bucket_span` of the ML job. So, if the `bucket_span` is `15m`, then your query in your Watch should look back over the last 30 minutes - something like:

```auto
          "query": {
            "bool": {
              "filter": [
                {
                  "term": {
                    "job_id": "my_jobname"
                  }
                },
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-30m"
                    }
                  }
                },
                {
                  "terms": {
                    "result_type": [
                      "bucket",
                      "record",
                      "influencer"
                    ]
                  }
                }
              ]
            }
          },

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2020, 1:41pm UTC](https://discuss.elastic.co/t/watcher-not-triggering-alerts/228304/3 "2020-05-16T13:41:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.